Hi,
Am 08.02.2012 13:51, schrieb Martin Bartosch:
>
>> I have a (severe?) issue with the SQL abstraction layer. I am using mysql as
>> backend and unfortunatly no clue about other rdbms - therefore I need some
>> feedback if the issue is mysql only or not.
>>
>> Problem:
>> I am searching a certificate by its subject, the subject I am looking for
>> contains a backshlash character.
>>
>> my $issuer_dn = "OU=Trustcenter,O=Snakeoil\, Inc.,C=US";
>> CTX('dbi_backend')->first(
>> TABLE => 'CERTIFICATE',
>> COLUMNS => [ 'IDENTIFIER' ],
>> DYNAMIC => {
>> 'SUBJECT' => $issuer_dn,
>> 'PKI_REALM' => $pki_realm
>> });
>
> ...
>
> If anybody has a decent idea how to handle this properly please comment...I discussed the issue with Oliver via some private emails because I don't want to disgrace myself ;) Today we met us in Berlin and discussed it again on the way to the airport with the result that we think, it is much more productive to continue on the devel list. I checked the PostgreSQL documentation because this is my favourite database. The documentation noticed that the actual SQL specification doesn't know an escape character in normal strings. PostgreSQL introduced a flag to enforce this behaviour but disables it actually by default because it would break old software. So what should we do? I would propose the following behaviour: 1. Every string in the database is a string without escape characters. "...\,..." is a backslash and comma. 2. The database layer does the same like the database. 3. The database drivers must ensure that no character is interpreted as a special character. 3.1. PostgreSQL knows an option for this. LIKE '....' ESCAPE '' 3.2. MySQL needs some support from Perl: $like =~ s/\\/\\\\/g; # or another conversion 3.3. What is with the other databases? Is it really so easy? 4. We should only use like if it is explicitly requested. I think the proposal from Oliver makes sense. It reduces the potential problem in a significant way. If the proposal is not exactly correct then (Oli) please fix it! My last active development action for OpenXPKI is a long time ago. Best regards Michael -- ___________________________________________________________________ Michael Bell Humboldt-Universitaet zu Berlin Tel.: +49 (0)30-2093 70143 ZE Computer- und Medienservice Fax: +49 (0)30-2093 70135 Unter den Linden 6 [email protected] D-10099 Berlin ___________________________________________________________________ PGP Fingerprint: 09E4 3D29 4156 2774 0F2C C643 D8BD 1918 2030 5AAB
smime.p7s
Description: S/MIME Kryptografische Unterschrift
------------------------------------------------------------------------------ Virtualization & Cloud Management Using Capacity Planning Cloud computing makes use of virtualization - but cloud computing also focuses on allowing computing to be delivered as a service. http://www.accelacomm.com/jaw/sfnl/114/51521223/
_______________________________________________ OpenXPKI-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-devel
